@spacefast/common 0.0.5 → 0.0.7

package/dist/contracts/space-config.d.ts

@@ -2,8 +2,7 @@ import { z } from "zod";
 export declare const SPACE_CONFIG_CANONICAL_FILE = "sf.jsonc";
 export declare const SPACE_CONFIG_ALIAS_FILES: readonly ["spacefast.jsonc", "spacefast.json", "sf.json", ".sf/sf.json", ".sf/config.jsonc", ".sf/config.json"];
 export declare const SPACE_CONFIG_ACCEPTED_FILES: readonly ["sf.jsonc", "spacefast.jsonc", "spacefast.json", "sf.json", ".sf/sf.json", ".sf/config.jsonc", ".sf/config.json"];
-export declare const SPACE_CONFIG_RETIRED_FILES: readonly ["stattic.jsonc", "stattic.json"];
-export declare const SPACE_CONFIG_PRIVATE_FILES: readonly ["sf.jsonc", "spacefast.jsonc", "spacefast.json", "sf.json", ".sf/sf.json", ".sf/config.jsonc", ".sf/config.json", "stattic.jsonc", "stattic.json"];
+export declare const SPACE_CONFIG_PRIVATE_FILES: readonly ["sf.jsonc", "spacefast.jsonc", "spacefast.json", "sf.json", ".sf/sf.json", ".sf/config.jsonc", ".sf/config.json"];
 export declare const SPACE_CONFIG_CAPS: {
     /** Max raw `sf.jsonc` size in bytes. */
     readonly fileBytes: number;
@@ -18,9 +17,44 @@ export declare const SPACE_CONFIG_CAPS: {
     readonly injectSnippetBytes: number;
     /** Max snippets per `inject` array. */
     readonly injectSnippets: 16;
+    /** Max `access.rules` entries in the file lane. */
+    readonly accessRules: 100;
+    /** Max `pages.theme` color token length. */
+    readonly pagesColorChars: 64;
+    /** Max `pages.theme.logo` URL/path length. */
+    readonly pagesLogoChars: 2000;
+    /** Max `pages.theme.name` display-name length. */
+    readonly pagesNameChars: 120;
 };
 /** Published JSON Schema URL for `sf.jsonc` ($schema autocomplete). */
 export declare const SPACE_CONFIG_SCHEMA_URL: string;
+export declare const spacePagesThemeSchema: z.ZodObject<{
+    accent: z.ZodOptional<z.ZodString>;
+    background: z.ZodOptional<z.ZodString>;
+    logo: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    fontFamily: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SpacePagesTheme = z.infer<typeof spacePagesThemeSchema>;
+export declare const SF_THEME_JSONC_FILE = "sf.theme.jsonc";
+export declare const sfThemeJsoncSchema: z.ZodObject<{
+    accent: z.ZodOptional<z.ZodString>;
+    background: z.ZodOptional<z.ZodString>;
+    logo: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    fontFamily: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const THEME_JSON_FILE = "theme.json";
+export declare const LAYOUT_TEMPLATE_FILE = ".spacefast/templates/layout.html";
+export declare const spacePagesConfigSchema: z.ZodObject<{
+    theme: z.ZodOptional<z.ZodObject<{
+        accent: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        logo: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        fontFamily: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const spaceBuildSettingsSchema: z.ZodObject<{
     rootDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     installDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -34,12 +68,26 @@ export declare const spaceBuildSettingsSchema: z.ZodObject<{
     timeoutSeconds: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type SpaceBuildSettings = z.infer<typeof spaceBuildSettingsSchema>;
+export declare const spacePlacementModeSchema: z.ZodEnum<{
+    shared: "shared";
+    dedicated: "dedicated";
+}>;
+export declare const spacePlacementConfigSchema: z.ZodObject<{
+    region: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        shared: "shared";
+        dedicated: "dedicated";
+    }>>;
+    burstable: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type SpacePlacementConfig = z.infer<typeof spacePlacementConfigSchema>;
 export declare const spaceConfigSchema: z.ZodObject<{
     index: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     fallback: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         path: z.ZodString;
         status: z.ZodNumber;
     }, z.core.$strip>]>>;
+    cleanUrls: z.ZodOptional<z.ZodBoolean>;
     listing: z.ZodOptional<z.ZodBoolean>;
     meta: z.ZodOptional<z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
@@ -72,6 +120,7 @@ export declare const spaceConfigSchema: z.ZodObject<{
                     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 }, z.core.$strip>>>;
             }, z.core.$strip>>;
+            requireReview: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     templates: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -98,6 +147,15 @@ export declare const spaceConfigSchema: z.ZodObject<{
             }, z.core.$strip>>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    pages: z.ZodOptional<z.ZodObject<{
+        theme: z.ZodOptional<z.ZodObject<{
+            accent: z.ZodOptional<z.ZodString>;
+            background: z.ZodOptional<z.ZodString>;
+            logo: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            fontFamily: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     build: z.ZodOptional<z.ZodObject<{
         rootDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         installDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -110,6 +168,15 @@ export declare const spaceConfigSchema: z.ZodObject<{
         allowUnsupportedPlatformFeatures: z.ZodOptional<z.ZodBoolean>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    placement: z.ZodOptional<z.ZodObject<{
+        region: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            shared: "shared";
+            dedicated: "dedicated";
+        }>>;
+        burstable: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    markdownNegotiation: z.ZodOptional<z.ZodBoolean>;
     experimental_gutenberg: z.ZodOptional<z.ZodBoolean>;
     inject: z.ZodOptional<z.ZodObject<{
         head: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -120,12 +187,69 @@ export declare const spaceConfigSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type SpaceConfig = z.infer<typeof spaceConfigSchema>;
 export declare function spaceSuperpowersEnabled(config: SpaceConfig | null | undefined): boolean;
+export declare const spaceAccessConfigSchema: z.ZodObject<{
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodDefault<z.ZodObject<{
+            host: z.ZodOptional<z.ZodString>;
+            hostPattern: z.ZodOptional<z.ZodString>;
+            hostTemplate: z.ZodOptional<z.ZodString>;
+            pathPattern: z.ZodOptional<z.ZodString>;
+            channel: z.ZodOptional<z.ZodString>;
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            agent: z.ZodOptional<z.ZodString>;
+            country: z.ZodOptional<z.ZodString>;
+            header: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+            challenge: "challenge";
+        }>;
+        auth: z.ZodOptional<z.ZodObject<{
+            requiredGrants: z.ZodArray<z.ZodString>;
+            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                alg: z.ZodLiteral<"EdDSA">;
+                publicKey: z.ZodString;
+                grantNamespaces: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"password">;
+                ref: z.ZodString;
+                transport: z.ZodEnum<{
+                    basic: "basic";
+                    form: "form";
+                }>;
+                username: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"login">;
+                url: z.ZodString;
+                label: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>], "type">>>;
+        }, z.core.$strip>>;
+        managedBy: z.ZodOptional<z.ZodEnum<{
+            sharing: "sharing";
+            firewall: "firewall";
+            file_share: "file_share";
+            cast_reviewer: "cast_reviewer";
+            team_default: "team_default";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        reasonCode: z.ZodOptional<z.ZodString>;
+        message: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 export declare const spaceConfigFileSchema: z.ZodObject<{
     index: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     fallback: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         path: z.ZodString;
         status: z.ZodNumber;
     }, z.core.$strip>]>>;
+    cleanUrls: z.ZodOptional<z.ZodBoolean>;
     listing: z.ZodOptional<z.ZodBoolean>;
     meta: z.ZodOptional<z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
@@ -158,6 +282,7 @@ export declare const spaceConfigFileSchema: z.ZodObject<{
                     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 }, z.core.$strip>>>;
             }, z.core.$strip>>;
+            requireReview: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     templates: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -184,6 +309,15 @@ export declare const spaceConfigFileSchema: z.ZodObject<{
             }, z.core.$strip>>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    pages: z.ZodOptional<z.ZodObject<{
+        theme: z.ZodOptional<z.ZodObject<{
+            accent: z.ZodOptional<z.ZodString>;
+            background: z.ZodOptional<z.ZodString>;
+            logo: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            fontFamily: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     build: z.ZodOptional<z.ZodObject<{
         rootDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         installDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -196,6 +330,15 @@ export declare const spaceConfigFileSchema: z.ZodObject<{
         allowUnsupportedPlatformFeatures: z.ZodOptional<z.ZodBoolean>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    placement: z.ZodOptional<z.ZodObject<{
+        region: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            shared: "shared";
+            dedicated: "dedicated";
+        }>>;
+        burstable: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    markdownNegotiation: z.ZodOptional<z.ZodBoolean>;
     experimental_gutenberg: z.ZodOptional<z.ZodBoolean>;
     inject: z.ZodOptional<z.ZodObject<{
         head: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -205,6 +348,62 @@ export declare const spaceConfigFileSchema: z.ZodObject<{
     }, z.core.$strip>>;
     $schema: z.ZodOptional<z.ZodString>;
     space: z.ZodOptional<z.ZodString>;
+    access: z.ZodOptional<z.ZodObject<{
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            match: z.ZodDefault<z.ZodObject<{
+                host: z.ZodOptional<z.ZodString>;
+                hostPattern: z.ZodOptional<z.ZodString>;
+                hostTemplate: z.ZodOptional<z.ZodString>;
+                pathPattern: z.ZodOptional<z.ZodString>;
+                channel: z.ZodOptional<z.ZodString>;
+                ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                agent: z.ZodOptional<z.ZodString>;
+                country: z.ZodOptional<z.ZodString>;
+                header: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                    value: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            effect: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+                challenge: "challenge";
+            }>;
+            auth: z.ZodOptional<z.ZodObject<{
+                requiredGrants: z.ZodArray<z.ZodString>;
+                issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    kid: z.ZodString;
+                    alg: z.ZodLiteral<"EdDSA">;
+                    publicKey: z.ZodString;
+                    grantNamespaces: z.ZodArray<z.ZodString>;
+                }, z.core.$strip>>>;
+                acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    type: z.ZodLiteral<"password">;
+                    ref: z.ZodString;
+                    transport: z.ZodEnum<{
+                        basic: "basic";
+                        form: "form";
+                    }>;
+                    username: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>, z.ZodObject<{
+                    type: z.ZodLiteral<"login">;
+                    url: z.ZodString;
+                    label: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>], "type">>>;
+            }, z.core.$strip>>;
+            managedBy: z.ZodOptional<z.ZodEnum<{
+                sharing: "sharing";
+                firewall: "firewall";
+                file_share: "file_share";
+                cast_reviewer: "cast_reviewer";
+                team_default: "team_default";
+            }>>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            reasonCode: z.ZodOptional<z.ZodString>;
+            message: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type SpaceConfigFile = z.infer<typeof spaceConfigFileSchema>;
 /**

package/dist/contracts/space-config.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
 import { BRAND } from "../brand.js";
+import { runtimeRuleSchema } from "./access.js";
+import { normalizedSiteClass } from "./enums.js";
 import { spaceThemeSchema } from "./space-theme.js";
 export const SPACE_CONFIG_CANONICAL_FILE = "sf.jsonc";
 export const SPACE_CONFIG_ALIAS_FILES = [
@@ -14,11 +16,7 @@ export const SPACE_CONFIG_ACCEPTED_FILES = [
     SPACE_CONFIG_CANONICAL_FILE,
     ...SPACE_CONFIG_ALIAS_FILES,
 ];
-export const SPACE_CONFIG_RETIRED_FILES = ["stattic.jsonc", "stattic.json"];
-export const SPACE_CONFIG_PRIVATE_FILES = [
-    ...SPACE_CONFIG_ACCEPTED_FILES,
-    ...SPACE_CONFIG_RETIRED_FILES,
-];
+export const SPACE_CONFIG_PRIVATE_FILES = [...SPACE_CONFIG_ACCEPTED_FILES];
 // Config compiler parser-safety caps (internal-docs/platform.md "Config
 // compiler scale targets"): hard from launch, enforced by ONE shared validator
 // at every intake seam — finalize for the `sf.jsonc` file, request
@@ -38,9 +36,96 @@ export const SPACE_CONFIG_CAPS = {
     injectSnippetBytes: 8 * 1024,
     /** Max snippets per `inject` array. */
     injectSnippets: 16,
+    /** Max `access.rules` entries in the file lane. */
+    accessRules: 100,
+    /** Max `pages.theme` color token length. */
+    pagesColorChars: 64,
+    /** Max `pages.theme.logo` URL/path length. */
+    pagesLogoChars: 2000,
+    /** Max `pages.theme.name` display-name length. */
+    pagesNameChars: 120,
 };
 /** Published JSON Schema URL for `sf.jsonc` ($schema autocomplete). */
 export const SPACE_CONFIG_SCHEMA_URL = `${BRAND.websiteOrigin}/schemas/sf.json`;
+// Platform-page theme tokens (access-plan §5.7 tier 1, X-16): colors, logo,
+// display name applied to the runtime's platform-rendered gate pages
+// (challenge/deny). Presentation only — never layout, behavior, or protocol.
+// Color grammar mirrors the SpaceTheme compiler allowlist (hex/rgb(a)/hsl(a)/
+// named), categorically rejecting anything that could escape a style context.
+const PAGES_COLOR_PATTERN = new RegExp([
+    "^(?:",
+    "#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})",
+    "|rgba?\\([0-9.,\\s%/]{1,64}\\)",
+    "|hsla?\\([0-9.,\\s%deg/]{1,64}\\)",
+    "|[a-zA-Z]{3,30}", // CSS named colors (transparent, rebeccapurple, ...)
+    ")$",
+].join(""));
+// Logo: an https URL or a root-relative path into the space's own files.
+const PAGES_LOGO_PATTERN = /^(?:https:\/\/[^\s"'<>\\]+|\/[^\s"'<>\\]*)$/;
+const pagesColorSchema = z
+    .string()
+    .trim()
+    .max(SPACE_CONFIG_CAPS.pagesColorChars)
+    .regex(PAGES_COLOR_PATTERN, "must be a hex, rgb(a), hsl(a), or named CSS color");
+// Font family stack for gate pages (access-plan §8 tier 3): mirrors the
+// SpaceTheme compiler's FONT_FAMILY_PATTERN allowlist (letters/digits/space/
+// comma/hyphen/straight quotes only, no url()/src).
+const PAGES_FONT_FAMILY_PATTERN = /^[A-Za-z0-9 ,'"-]{1,256}$/;
+export const spacePagesThemeSchema = z
+    .object({
+    accent: pagesColorSchema.optional().describe("Accent color for buttons/links on gate pages."),
+    background: pagesColorSchema.optional().describe("Page background color for gate pages."),
+    logo: z
+        .string()
+        .trim()
+        .max(SPACE_CONFIG_CAPS.pagesLogoChars)
+        .regex(PAGES_LOGO_PATTERN, "must be an https:// URL or a root-relative path")
+        .optional()
+        .describe("Logo image (https URL or root-relative path) shown in the brand row."),
+    name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(SPACE_CONFIG_CAPS.pagesNameChars)
+        .optional()
+        .describe("Display name shown in the brand row of gate pages."),
+    // Free tier ("basic color scheme + fonts", access-plan §9): a validated
+    // font-family stack applied to gate pages, same grammar as the SpaceTheme
+    // compiler's typography.fontFamily.
+    fontFamily: z
+        .string()
+        .trim()
+        .max(256)
+        .regex(PAGES_FONT_FAMILY_PATTERN, "must be a plain font-family stack (no url()/src)")
+        .optional()
+        .describe("Font-family stack applied to gate pages."),
+})
+    .describe("Theme tokens for platform-rendered gate pages (challenge/deny).");
+// The `sf.theme.jsonc` escape-hatch file (access-plan §8 tier 3, wins over
+// `theme.json` and `spacefast.jsonc "pages.theme"`): same gate-page token
+// vocabulary as `pages.theme`, just from a dedicated file so authors/agents
+// can hand-tune presentation without touching the main project config. Paid
+// tier ("advanced theming", access-plan §9) — gated at compile by the
+// resolved plan entitlement, never at parse time.
+export const SF_THEME_JSONC_FILE = "sf.theme.jsonc";
+export const sfThemeJsoncSchema = spacePagesThemeSchema.describe("sf.theme.jsonc: the highest-precedence gate-page theme override file.");
+// The WordPress-compatible `theme.json` file (access-plan §8 tier 3, middle
+// precedence): free tier ("theme.json basics"). Only `settings.color.palette`
+// and `settings.typography.fontFamilies` feed gate-page tokens; every other
+// WP theme.json key is accepted-and-ignored (this is not a full WP_Theme_JSON
+// reimplementation, just the safe subset that reaches presentation-only gate
+// pages).
+export const THEME_JSON_FILE = "theme.json";
+// Custom chrome/shell for gate pages (access-plan §8 tier 2): the functional
+// challenge/deny fragment slots into `<div data-sf="content">` here so gate
+// pages inherit site look. Paid tier, same entitlement as full custom
+// 401.html/403.html.
+export const LAYOUT_TEMPLATE_FILE = ".spacefast/templates/layout.html";
+export const spacePagesConfigSchema = z
+    .object({
+    theme: spacePagesThemeSchema.optional(),
+})
+    .describe("Platform-page presentation: theme tokens applied to gate pages.");
 export const spaceBuildSettingsSchema = z
     .object({
     rootDirectory: z.string().trim().min(1).nullable().optional(),
@@ -56,6 +141,18 @@ export const spaceBuildSettingsSchema = z
 })
     .strict()
     .describe("Remote build settings used by repository builds.");
+// Reuses the same shared/dedicated vocabulary as `normalizedSiteClass`
+// (enums.ts) rather than declaring a second "shared"/"dedicated" enum —
+// space placement mode and normalized site class are the same axis.
+export const spacePlacementModeSchema = normalizedSiteClass;
+export const spacePlacementConfigSchema = z
+    .object({
+    region: z.string().trim().min(1).optional(),
+    mode: spacePlacementModeSchema.optional(),
+    burstable: z.boolean().optional(),
+})
+    .strict()
+    .describe("Placement controls for this space.");
 // SpaceConfig (internal-docs/platform.md "SpaceConfig"): the declarative
 // serving config — also the shape of `sf.jsonc` minus `$schema`/`space`.
 // Meta caps are the spec parser-safety numbers (title 300, description 1000,
@@ -75,6 +172,10 @@ export const spaceConfigSchema = z.object({
     ])
         .optional()
         .describe('Fallback document; "/index.html" means SPA. Default: nearest 404.html.'),
+    cleanUrls: z
+        .boolean()
+        .optional()
+        .describe("Serve flat `<name>.html` files at their extensionless URL (/about serves about.html). Default: on, unless a 200-status SPA fallback is configured."),
     listing: z.boolean().optional().describe("Enable automatic directory listings."),
     meta: z
         .object({
@@ -127,6 +228,10 @@ export const spaceConfigSchema = z.object({
                     .optional(),
             })
                 .optional(),
+            requireReview: z
+                .boolean()
+                .optional()
+                .describe("When true, integration changes must go through review before release."),
         })
             .optional(),
     })
@@ -140,9 +245,17 @@ export const spaceConfigSchema = z.object({
     theme: spaceThemeSchema
         .optional()
         .describe("Platform-page theming: a validated preset subset of WordPress theme.json."),
+    pages: spacePagesConfigSchema
+        .optional()
+        .describe("Platform gate-page presentation: theme tokens (access-plan §5.7 tier 1)."),
     build: spaceBuildSettingsSchema
         .optional()
         .describe("Default settings for remote repository builds."),
+    placement: spacePlacementConfigSchema.optional(),
+    markdownNegotiation: z
+        .boolean()
+        .optional()
+        .describe("Accepted serving flag; runtime enforcement ships separately."),
     // Intentionally undescribed (hidden, experimental): enables the finalize-time
     // build pipeline (internal-docs/build-pipeline-plan.md). Accepted without
     // diagnostics; absent/false keeps today's behavior byte-for-byte.
@@ -163,6 +276,22 @@ export function spaceSuperpowersEnabled(config) {
     const superpowers = config?.superpowers;
     return superpowers?.enabled !== false && superpowers?.disable_all_injection !== true;
 }
+// The declarative file-lane access/firewall block (internal-docs/
+// internal-docs/access-plan.html, "file" provenance): the SAME unified Rule shape
+// the policy document and the cloud lane use — no parallel contract. Rules
+// committed here compile at publish finalize and version + roll back WITH the
+// content version; live edits without a republish belong to the cloud lane
+// (`sf access`). The file lane lives ONLY in the config FILE — the API `config`
+// overlay never carries it (single-home, no drift).
+export const spaceAccessConfigSchema = z
+    .object({
+    rules: z
+        .array(runtimeRuleSchema)
+        .max(SPACE_CONFIG_CAPS.accessRules)
+        .default([])
+        .describe("Ordered unified access/firewall rules; first match wins."),
+})
+    .describe("Declarative access lane: rules compiled at publish that version and roll back with the site.");
 // The `sf.jsonc` FILE shape (internal-docs/platform.md "Space
 // Configuration Files"): SpaceConfig plus the editor `$schema` pointer and the
 // optional `space` link (slug or `spc_` id) resolved by CLI/publish flows.
@@ -178,6 +307,7 @@ export const spaceConfigFileSchema = spaceConfigSchema.extend({
         .min(1)
         .optional()
         .describe("Optional space link: a space slug or spc_ id this project publishes to."),
+    access: spaceAccessConfigSchema.optional(),
 });
 /**
  * The published JSON Schema artifact for `sf.jsonc`, generated from the